CVE-2025-49405

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Favethemes Houzez allows PHP Local File Inclusion.This issue affects Houzez: from n/a before 4.1.4.

Score

CVSS 3.1 4.3 Medium

Status

Deferred - audit@patchstack.com

Published

2025-08-28

Last modified

2026-10-18

Weaknesses

CWE-98

Affected products

• Houzez (Favethemes)

References

• https://patchstack.com/database/wordpress/theme/houzez/vulnerability/wordpress-houzez-theme-4-1-1-local-file-inclusion-…